CVEs published October 24, 2018
35 CVEs were published on October 24, 2018: 0 critical, 1 high.
- Published
- 35
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- GAIN Electronic Co. SAGA1-L8B
- 3
- Apache Software Foundation Apache Impala
- 2
- salt
- 2
- ajenti
- 1
- Apache Software Foundation Apache Spark · org.apache.spa… +1
- 1
- Cisco WebEx Event Center
- 1
- Fuji Electric Energy Savings Estimator
- 1
- IBM WebSphere Commerce Enterprise
- 1
- mysql-binuuid-rails
- 1
- Telecrane F25 Series
- 1
High 1
Medium, low and unrated 34
- CVE-2018-13342The server API in the Anda app relies on hardcoded credentials.
- CVE-2018-15750Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to detesalt
- CVE-2018-15751SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands vsalt
- CVE-2018-17903SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.GAIN Electronic Co. SAGA1-L8B
- CVE-2018-17921SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without GAIN Electronic Co. SAGA1-L8B
- CVE-2018-17923SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may ablGAIN Electronic Co. SAGA1-L8B
- CVE-2018-18551ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type pa
- CVE-2018-18552ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK
- CVE-2018-18566The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration in
- CVE-2018-18567AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by lev
- CVE-2018-18568Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by lev
- CVE-2018-18621CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email
- CVE-2018-18638A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary command
- CVE-2018-8955The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al
- CVE-2016-10729An issue was discovered in Amanda 3.3.1.
- CVE-2016-10730An issue was discovered in Amanda 3.3.1.
- CVE-2018-12650Adrenalin HRMS version 5.4.0 contains a Reflected Cross Site Scripting (XSS) vulnerability in the ApplicationtEmployeeSearch page via 'prntD
- CVE-2018-14812An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1Fuji Electric Energy Savings Estimator
- CVE-2018-18013* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input.
- CVE-2018-18014* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making re
- CVE-2018-18476mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.mysql-binuuid-rails
- CVE-2018-18517Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.
- CVE-2018-18547Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period par
- CVE-2018-18548ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.ajenti
- CVE-2018-18635www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows
- CVE-2018-18636XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.
- CVE-2018-9279An issue was discovered on Eaton UPS 9PX 8000 SP devices.
- CVE-2018-9280An issue was discovered on Eaton UPS 9PX 8000 SP devices.
- CVE-2018-9281An issue was discovered on Eaton UPS 9PX 8000 SP devices.
- CVE-2018-11785Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into aApache Software Foundation Apache Impala
- CVE-2018-11792In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table.Apache Software Foundation Apache Impala
- CVE-2018-1541IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting.IBM WebSphere Commerce Enterprise
- CVE-2018-17935All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission.Telecrane F25 Series
- CVE-2018-11804Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation.Apache Software Foundation Apache Spark · org.apache.spa… +1